GDPR

1. Our role

We are the controller for your account, the social accounts you connect, the content you create and schedule, and our logs. The networks you publish to are separate controllers for the content once it's posted.

2. Lawful bases

• Contract: running your account, connecting your social accounts, and storing and publishing your posts.
• Legitimate interests: security, abuse prevention, server logs, backups, and service messages about your account (for example a failed post).
• Legal obligation: records we must keep by law and responses to lawful requests.
• Consent: not used today. We set no optional cookies; we'll ask first if that changes.

3. Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to a supervisory authority.

4. How to exercise your rights

You can disconnect channels and delete your account yourself (see data deletion). For any other request, email support@flexrop.com with the subject “Privacy request”. We may confirm your identity first, and we respond within one month. Complex or numerous requests can take up to two more months, and we'll tell you if so.

We have not appointed a Data Protection Officer or an EU or UK representative.

5. International transfers

The application and database are hosted in the EU (France). Uploaded images and videos are stored in the USA (AWS us-east-2), and the networks you publish to may process data worldwide. Where required, transfers rely on the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.

6. Data Processing Agreement

Business customers who need an Article 28 Data Processing Agreement can request one from support@flexrop.com.

7. Subprocessors

• Contabo GmbH: application and database hosting (EU, France).
• Amazon Web Services: storage for uploaded images and videos (S3, USA, us-east-2).

We'll update this list before adding a new subprocessor.

8. Security and breach notification

We use HTTPS, hashed passwords, signed sessions, restricted server access and daily backups, and social account credentials never leave our servers. If a breach affects your personal data, we'll notify you without undue delay.

9. Retention

Account data and content are kept while your account is active and removed immediately when you delete it; backups roll off within 14 days. Web server logs are kept for 14 days. Details are in the privacy policy.

10. California residents (CCPA/CPRA)

We don't sell or share personal information. You can ask to know, delete or correct your personal information through the contact below, and you won't be treated differently for doing so.

11. Complaints

Please contact us first so we can help. You can also complain to a supervisory authority: in the EEA, the authority in the country where you live or work or where the issue arose; in the UK, the Information Commissioner's Office.

Contact

PILOTLAB LLC, 304 S. Jones Blvd, Las Vegas, Nevada 89107, USA. Email support@flexrop.com or call 1 888 370 6801.